Merge commit from fork

normanmaurer · web-flow · commit 541ca7c645b8 · 2026-05-04T13:34:02.000-07:00
Motivation:

We should validate if the requested length is actual valid and readable before we try to allocate it to guard against excessive memory usage caused by a malformated request

Modifications:

Add length check and throw if not pass

Result:

Guard against excessive memory usage caused by malformated request
diff --git a/codec-http3/src/main/java/io/netty/handler/codec/http3/QpackDecoder.java b/codec-http3/src/main/java/io/netty/handler/codec/http3/QpackDecoder.java
@@ -47,6 +47,9 @@ final class QpackDecoder {
     private static final QpackException INVALID_REQUIRED_INSERT_COUNT =
             QpackException.newStatic(QpackDecoder.class, "decodeRequiredInsertCount(...)",
                     "QPACK - invalid required insert count");
+    private static final QpackException INVALID_LENGTH_ENCODED_LITERAL =
+            QpackException.newStatic(QpackDecoder.class, "decodeHuffmanEncodedLiteral(...)",
+                    "QPACK - invalid length for LITERAL");
     private static final QpackException MAX_BLOCKED_STREAMS_EXCEEDED =
             QpackException.newStatic(QpackDecoder.class, "shouldWaitForDynamicTableUpdates(...)",
                     "QPACK - exceeded max blocked streams");
@@ -399,6 +402,9 @@ private CharSequence decodeHuffmanEncodedLiteral(ByteBuf in, int prefix) throws
         if (huffmanEncoded) {
             return huffmanDecoder.decode(in, length);
         }
+        if (in.readableBytes() < length) {
+            throw INVALID_LENGTH_ENCODED_LITERAL;
+        }
         byte[] buf = new byte[length];
         in.readBytes(buf);
         return new AsciiString(buf, false);
diff --git a/codec-http3/src/main/java/io/netty/handler/codec/http3/QpackEncoderHandler.java b/codec-http3/src/main/java/io/netty/handler/codec/http3/QpackEncoderHandler.java
@@ -32,7 +32,9 @@
 import static io.netty.util.internal.ObjectUtil.checkInRange;
 
 final class QpackEncoderHandler extends ByteToMessageDecoder {
-
+    private static final QpackException INVALID_LENGTH_STRING_LITERAL =
+            QpackException.newStatic(QpackEncoderHandler.class, "decodeStringLiteral(...)",
+                    "QPACK - invalid length for STRING_LITERAL");
     private final QpackHuffmanDecoder huffmanDecoder;
     private final QpackDecoder qpackDecoder;
     private boolean discard;
@@ -240,6 +242,9 @@ private CharSequence decodeStringLiteral(ByteBuf in, boolean huffmanEncoded, int
         if (huffmanEncoded) {
             return huffmanDecoder.decode(in, length);
         }
+        if (in.readableBytes() < length) {
+            throw INVALID_LENGTH_STRING_LITERAL;
+        }
         byte[] buf = new byte[length];
         in.readBytes(buf);
         return new AsciiString(buf, false);
diff --git a/codec-http3/src/main/java/io/netty/handler/codec/http3/QpackHuffmanDecoder.java b/codec-http3/src/main/java/io/netty/handler/codec/http3/QpackHuffmanDecoder.java
@@ -4649,6 +4649,9 @@ final class QpackHuffmanDecoder implements ByteProcessor {
     private static final QpackException BAD_ENCODING =  QpackException.newStatic(QpackHuffmanDecoder.class,
             "decode(...)", "QPACK - Bad Encoding");
 
+    private static final QpackException INVALID_LENGTH =  QpackException.newStatic(QpackHuffmanDecoder.class,
+            "decode(...)", "QPACK - Invalid length");
+
     private byte[] dest;
     private int k;
     private int state;
@@ -4666,6 +4669,9 @@ public AsciiString decode(ByteBuf buf, int length) throws QpackException {
         if (length == 0) {
             return AsciiString.EMPTY_STRING;
         }
+        if (buf.readableBytes() < length) {
+            throw INVALID_LENGTH;
+        }
         dest = new byte[length * 8 / 5];
         try {
             int readerIndex = buf.readerIndex();
